CVE-2025-65237

MediumCVSS 6.1

Published: 26/11/2025(UTC)Updated: 04/11/2026(UTC)Translated: 05/11/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

22th percentile - higher than 22% of all known CVEs

Summary

A reflected cross-site scripting (XSS) vulnerability in OpenCode Systems USSD Gateway OC Release: 5 allows attackers to execute arbitrary JavaScript in the context of a user's browser via injecting a crafted payload.

Risk Assessment

An attacker can hijack a user's session, steal credentials, or perform other malicious actions on behalf of the victim, potentially leading to system compromise.

Recommendation

Implement proper input validation and encoding mechanisms to prevent injection of malicious code, and consider updating to a version that fixes this vulnerability.

Other vulnerabilities in OpenCode Systems USSD Gateway OC

CVE-2025-65239Medium
Incorrect access control in the /aux1/ocussd/trace endpoint of OpenCode Systems USSD Gateway OC Release:5, version 6.13.11 allows attackers with low-level privileges to read server logs.

Original NVD description (English source)

A reflected cross-site scripted (XSS) vulnerability in OpenCode Systems USSD Gateway OC Release: 5 allows attackers to execute arbitrary JavaScript in the context of a user's browser via injecting a crafted payload.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS